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DETAILED ACTION 

Status of Claims 

1 . Due to communications filed 7/7/08, the following is a non-final office action. 
Claims 1-26 are pending in this application and have been examined on the merits. The 
previous rejection has been withdrawn, and prosecution has now been re-opened. 
Claims 1-26 are now rejected as follows. 

Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 1 02 of this title, if the differences between the subject matter sought to be patented and the 
prior art are such that the subject matter as a whole would have been obvious at the time the invention 
was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability 
shall not be negatived by the manner in which the invention was made. 

3. Claims 1-25 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Breslin et al (US 2004/0098285 A1 ). 

As per Claim 1 , Breslin et al discloses a customer relationship management 
(CRM) system that is accessible via a network, ([0009], core repository that manages, 
monitors and measures all data privacy assessments across an institution, [0030], using 
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a distributed client/server architecture , w/[0031], client is a web-based browser 
application), comprising: 

-a user interface that provides distributed access for customers and support 
providers to case information within the CRM system, wherein the user interface 
provides access to a customer case management page for viewing all cases opened for 
a given customer and a case summary page for viewing details of individual cases 
stored within the CRM system, ([0013], user interface that allows upper management to 
review risk exposure and compliance status) 

- a case management system for managing customer cases, wherein the case 
management system includes a system for assigning cases to different tiers within a 
support provider hierarchy; ([0015], access levels for review of risk exposure and 
compliance) and 

-a compliance tracking system that retrieves previously loaded customer 
compliance data from a database, ([0055], shows database can be consulted when 
system determines the compliance of the application with the laws and regulations of 
the jurisdictions in which the application operates); 

wherein the compliance data consists of information related to whether a 
customer has met certain required pre-set goals set by the CRM system, compares the 
compliance data for each customer with predetermined levels to determine customer 
compliance and provides a compliance indicator on the customer case management 
page, ([0012], shows compliance with applicable sate and Federal laws is assessed and 
once risk is acknowledged, a plan for reducing the risk or bringing the groups 
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procedures into compliance can be formulated, and progress towards compliance can 
be tracked, and [0069], compliance indicator is displayed, in this case comparing is 
obvious since compliance with applicable state and Federal laws requires some type of 
comparison between current applications and the state and Federal laws). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to compare compliance data for each customer with predetermined 
levels with the motivation of determining current compliance data. 

As per Claim 2, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a notification system for 
automatically generating emails when a new case is opened, ([0040], email notifying the 
person of the assignment and the responsibilities associated therewith) 

As per Claim 3. Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a system that allows support 
providers to check-in/check-out cases, ([0040], when assignment is made, input screen 
shows date on which the assignment was accepted and updates the applicable 
database to record the assignment, [0045], shows alternate assignments, which makes 
checking out cases obvious since when re-assigning to an alternate application, the 
case must be checked out for the first application). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to check-out cases with the motivation of ending processing of a 
first case. 
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As per Claim 4, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a set of business rules that 
determines what level of case information is to be made available to customers and 
support providers. ([0014], higher level managers have broader access than lower level 
managers, which is based on seniority) 

As per Claim 5, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a set of business rules that 
determines how cases are to be assigned and escalated among the different tiers of 
support providers. ([0014], cases are assigned based on seniority) 

As per Claim 6, Breslin et al further discloses the CRM system of claim 1 , 
wherein the compliance tracking system includes a set of business rules that 
determines a compliance risk level for each customer. ([0014], ability to access risk 
assessment data) 

As per claims 7-8, 12, 17 and 24-25 . Breslin et al discloses mostly all of the 
limitations including wherein the portal page provides access to a customer case 
management page for viewing all cases opened for a given customer and a case 
summary page for viewing details of individual cases as shown in [0004], where a 
summary or compiled data is shown. 

Breslin et al also discloses wherein the compliance risk level is selected from the 
group consisting of: in compliance, in danger of becoming out of compliance, and out of 
compliance in [0012], where compliance is shown with applicable sate and Federal laws 
is assessed and once risk is acknowledged, a plan for reducing the risk or bringing the 
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groups procedures into compliance can be formulated, and progress towards 
compliance can be tracked. 

Breslin et al also discloses and also wherein the compliance indicator comprises 
a traffic light indicator having a green, yellow, and red light as shown in [0073], where 
green, amber and red are shown as compliance indicators. In this case, amber 
represents yellow. 

As per Claim 9, Breslin et al further discloses the CRM system of claim 6, 
wherein the compliance tracking system includes a system for creating a new customer 
case when a predetermined compliance risk level occurs (abstract, lines 18-24, If a risk 
exists, a plan for reducing the risk or bringing the application into compliance can be 
formulated, and progress towards compliance can be tracked, w/[0010], shows a six- 
step system to bring status into compliance, which includes employing automated 
questionnaires, which is a step involved in processing of assessment for each 
application, which therefore suggests that the process is done for new applications 
since as shown in [0033], the person is just assigned to a particular application for the 
purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

As per Claim 10, Breslin et al further discloses a method for providing customer 
relationship management (CRM) via a computer network, comprising: 
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-providing a network node that allows distributed access for customers and 
support providers to a CRM System, ([0009], core repository that manages, monitors 
and measures all data privacy assessments across an institution, [0030], using a 
distributed client/server architecture , w/[0031], client is a web-based browser 
application); 

-opening a new case within the CRM system when a customer issue occurs; 
(abstract, lines 1 8-24, If a risk exists, a plan for reducing the risk or bringing the 
application into compliance can be formulated, and progress towards compliance can 
be tracked, w/[0010], shows a six-step system to bring status into compliance, which 
includes employing automated questionnaires, which is a step involved in processing of 
assessment for each application, which therefore suggests that the process is done for 
new applications since as shown in [0033], the person is just assigned to a particular 
application for the purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

- adding the new case to a customer case management page; ([0054], add 
button adds jurisdictions that are applicable to the application under review) 

- displaying a compliance indicator when the customer case management page 
is viewed; ([0069], compliance indicator is displayed); 
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wherein the compliance indicator is based on information related to whether a 
customer has met certain required pre-set goals set by the CRM system, ([0012], shows 
compliance with applicable sate and Federal laws is assessed and once risk is 
acknowledged, a plan for reducing the risk or bringing the groups procedures into 
compliance can be formulated, and progress towards compliance can be tracked); 

- assigning the new case to a first tier support provider; ([0033], lines 1-8, 
assignment to the manager in charge of the application, as this is the person in the 
organization with the most intimate knowledge about the current state of the operation 
of the application at any given time) 

The following is suggested by Breslin et al since access levels are assigned 
based on seniority or management status as shown in [0015], and higher management 
is shown to have more knowledge as shown in [0033]: 
-determining if the first tier support provider can handle the new case; and 
-escalating the new case to a second tier support provider if the first tier support 
provider cannot handle the case. 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to determine if the first tier support provider can handle the new 
case, and escalate the new case to a second tier support provider if the first tier support 
provider cannot handle the case with the motivation of providing a case for assessment 
to someone with more knowledge. 
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As per Claim 11. Breslin et al further discloses the method of claim 10, wherein the 
network node comprises a web portal. ([0035], application portal) 

As per Claim 13. Breslin et al further discloses the method of claim 10, comprising the 
further step of generating email notifications according to a set of business rules, 
([0040], email notifying the person of the assignment and the responsibilities associated 
therewith) 

As per Claim 14. Breslin et al discloses having an assigned support provider 
check out the case from the CRM system. ([0043], outside support providers). 

As per Claim 15. Breslin et al discloses, wherein the step of opening a new case 
is performed by the customer at the network node, ([0009], core repository that 
manages, monitors and measures all data privacy assessments across an institution, 
[0030], using a distributed client/server architecture , w/[0031], client is a web-based 
browser application); 

As per Claim 16. Breslin et al further discloses, wherein the step of opening a 
new case is initiated automatically when the customer is out of compliance. ([0046], 
assessment is accomplished automatically). 
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As per Claim 18, Breslin et al further discloses a program product stored on a 
recordable medium that provides a customer relationship management (CRM) tool via 
the web, comprising: 

-a portal page for providing distributed access on the web for customers and support 
providers to case information within the CRM tool, ([0035], application portal) 

-a customer management module for managing customer cases and for assigning 
cases to different tiers within a support provider hierarchy, ([0033], lines 1-8, 
assignment to the manager in charge of the application, as this is the person in the 
organization with the most intimate knowledge about the current state of the operation 
of the application at any given time and ([0015], access levels for review of risk 
exposure and compliance) and 

-a customer compliance module retrieves previously loaded customer compliance data 
from a database, ([0055], shows database can be consulted when system determines 
the compliance of the application with the laws and regulations of the jurisdictions in 
which the application operates); 



wherein the compliance data consists of information related to whether a 
customer has met certain required pre-set goals set by the CRM system, compares the 
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compliance data for each customer with predetermined levels to track customer 
compliance and displays a compliance indicator on customer case management page, 
([0012], shows compliance with applicable sate and Federal laws is assessed and once 
risk is acknowledged, a plan for reducing the risk or bringing the groups procedures into 
compliance can be formulated, and progress towards compliance can be tracked, and 
[0069], compliance indicator is displayed, in this case comparing is obvious since 
compliance with applicable state and Federal laws requires some type of comparison 
between current applications and the state and Federal laws). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to compare compliance data for each customer with predetermined 
levels with the motivation of determining current compliance data. 

As per Claim 19, Breslin et al further discloses the program product of claim 18, 
wherein the case management module further includes a notification system for 
automatically generating emails when a new case is opened, ([0040], email notifying the 
person of the assignment and the responsibilities associated therewith) 

As per Claim 20, Breslin et al further discloses the program product of claim 18, 
wherein the case management module further includes a system that allows support 
providers to check-in/check-out cases, ([0040], when assignment is made, input screen 
shows date on which the assignment was accepted and updates the applicable 
database to record the assignment, [0045], shows alternate assignments, which makes 
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checking out cases obvious since when re-assigning to an alternate application, the 
case must be checked out for the first application). 

As per Claim 21. Breslin et al further discloses the program product of claim 18, wherein 
the case management module further includes a set of business rules that determines 
what level of case information is to be made available to customers and support 
providers. ([0014], higher level managers have broader access than lower level 
managers, which is based on seniority) 

As per Claim 22, Breslin et al further discloses the program product of claim 18, wherein 
the case management module further includes a set of business rules that determines 
how cases are to be assigned and escalated among the different tiers of support 
providers. ([0014], cases are assigned based on seniority) 

As per Claim 23, Breslin et al further discloses the program product of claim 18, wherein 
the compliance tracking module includes a set of business rules that determines a 
compliance risk level for each customer. ([0014], ability to access risk assessment data) 

As per Claim 26, The program product of claim 23, wherein the compliance tracking 
module includes a system for creating a new customer case when a predetermined 
compliance risk level occurs, (abstract, lines 18-24, If a risk exists, a plan for reducing 
the risk or bringing the application into compliance can be formulated, and progress 
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towards compliance can be tracked, w/[0010], shows a six-step system to bring status 
into compliance, which includes employing automated questionnaires, which is a step 
involved in processing of assessment for each application, which therefore suggests 
that the process is done for new applications since as shown in [0033], the person is 
just assigned to a particular application for the purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

Response to Arguments 

4. Applicant's arguments with respect to claims 1-26 have been considered but are 
moot in view of the new ground(s) of rejection. 



Conclusion 

5. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Akiba K Robinson-Boyce whose telephone number is 
571-272-6734. The examiner can normally be reached on Monday-Friday 9am-5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Hayes can be reached on 571-272-6708. The fax phone number for 
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the organization where this application or proceeding is assigned is 571-273-8300. 
Information regarding the status of an application may be obtained from the 
•Patent Application Information Retrieval (PAIR) system, Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO 
Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
3900. 

A. R. B. 

September 23, 2008 



/Akiba K Robinson-Boyce/ 
Primary Examiner, Art Unit 3628 



